FBI Seizes 900 Webcam Clips Behind North Korea’s Fake-Call Heists

On November 12, 2026, the US Justice Department said it had taken down cloud servers behind FaceStealer, a North Korean scheme the FBI links to more than $400 million in stolen cryptocurrency over 18 months. Agents also seized more than 900 webcam recordings of victims, the raw material for the con.

Here’s how it runs. An account hijacked from an earlier victim on Telegram, LinkedIn, Slack, or Discord invites a contact into a copycat Zoom, Teams, or Google Meet call. The attackers replay footage of people the target knows, sometimes adding AI deepfakes of crypto figures, then fake an audio glitch whose “fix” installs malware.

Crypto and web3 workers are the main targets, but open-source maintainers are increasingly in the crosshairs, raising supply chain worries. The FBI ties the activity to groups tracked as APT38, BlueNoroff, and Sapphire Sleet, and says some thefts came more than a year after the first infection.

Source: BBC News